templates have no acls
templates have no acls
Hello,
when testing template for huma-num we encountered and issu, there is no acls for templates so we cannot restrict access to them on read only for exemple
the worflow is like this :
- we have template in fusiondirectory
- we want manager responsible of a branch to be able to use them
- we want manager responsible of a branch to be able to only have them in readonly mode
this is no possible right now. How can this be implemented
Cheers
(from redmine: issue id 4970, created on 2016-06-30, closed on 2016-07-06)
- Relations:
- copied_to #4982
- Changesets:
- Revision ffdd8cbe on 2016-07-04T09:29:16.000Z:
Fixes #4970 Added ACL category for user templates- Revision a35fc821 on 2016-07-04T09:31:45.000Z:
Fixes #4970 Added ACL category for user templates- Revision 40f12af9 on 2016-07-05T08:05:31.000Z:
Fixes #4970 Trying to fix the way base ACL is handled and to allow use of templates in any base- Revision cb726db0 on 2016-07-05T08:06:49.000Z:
Fixes #4970 Trying to fix the way base ACL is handled and to allow use of templates in any base- Revision 7eb27f63 on 2016-07-05T09:39:07.000Z:
Fixes #4970 Function plInfo should be static- Revision 05a6be4a on 2016-07-05T09:39:48.000Z:
Fixes #4970 Function plInfo should be static- Revision d8918765 on 2016-07-05T10:33:28.000Z:
Fixes #4970 Fixed actions ACLs in user list- Revision 9baf5681 on 2016-07-05T10:34:07.000Z:
Fixes #4970 fixed the way acl_base is set at plugin creation- Revision f5e19533 on 2016-07-05T10:35:38.000Z:
Fixes #4970 Fixed actions ACLs in user list- Revision cbb7d8db on 2016-07-05T10:35:52.000Z:
Fixes #4970 fixed the way acl_base is set at plugin creation- Revision 9697f788 on 2016-07-06T03:11:12.000Z:
Fixes #4970 Removed templates on which the user have no rights from template list- Revision 3848a24f on 2016-07-06T03:12:28.000Z:
Fixes #4970 Removed templates on which the user have no rights from template listActivity
If a user have read right on a template he can use the create user button but then all fields are greyed out and empty so he cannot use it. We should show the base field and maybe try and detect if the user have creation right on some base and pre-select it or something like this.
(from redmine: written on 2016-07-04)
By Côme Chilliet on 2017-09-02T15:31:12 (imported from GitLab)
hello,
i have made some complete test
-
Complete object: read
- i can read the template and everything is ghosted --> Result OK
- i can create a user from template, everything is gosted and i cannot create a user --> Result NOK
-
Complete object: read & write
- i can read the template and everything is open --> Result OK
- i can create a user from template, everything is gosted and i cannot create a user ----> RESULT NOK
-
template_cn read
- i can read the template and everything is open --> Result NOK
- i can create a user from template, everything is gosted and i cannot create a user ----> RESULT NOK
-
template_cn read & write
- i can read the template and everything is open --> Result OK
- i can create a user from template, everything is gosted and i cannot create a user ----> RESULT NOK
-
Create Objet & complete read
- i can read the template and everything is open --> Result NOK
- i can create a user from template, everything is gosted and i cannot create a user ----> RESULT NOK
The probleme i see is that we must be able to read the template aka acl read and use it to create user but not modify the template, no write access.
i hope i understood the new code well
Cheers
(from redmine: written on 2016-07-04)
By bmortier on 2017-09-02T15:31:12 (imported from GitLab)
-
Ok, I tried to fix the way ACLs on base are used, and I added base in the field asked when using a template. With this, a user which have enough rights to read a template can use it in any base where he has enough rights to create the target object.
Template edition on the other hand still uses user fields ACL, except for the cn field which uses the template_cn ACL.
(from redmine: written on 2016-07-05)
By Côme Chilliet on 2017-09-02T15:31:12 (imported from GitLab)
Hello,
i have an acl roles on manager on ou=branch1
9 cn=manager,ou=aclroles,ou=branch1,dc=fusiondirectory,dc=org cn: manager description: Donner tous les droits sur les utilisateurs de cette branche objectClass: top objectClass: gosaRole gosaAclTemplate: 0:user/password;cmdrw,user/posixAccount;cmdrw,user/user;cmdrw,user/userCertificates;r
who doesnt have the acl on the tamplate object
i have an acl assignment on ou=templates
subtree cn=manager,ou=aclroles,ou=branch1,dc=fusiondirectory,dc=org uid=manager1,ou=people,dc=fusiondirectory,dc=org
first side effect i'am no longer confined into branch1 os i'am root
i can use the create from template, select my branch and create the user that work look at hihi
when i'am in the branch1 i cannot use the create from template
Cheers
(from redmine: written on 2016-07-05)
By bmortier on 2017-09-02T15:31:12 (imported from GitLab)
Using From Template creation should work from anywhere now. (Hoping this does not break anything else). Also, menu creation options should now only be shown if the user have enough right. I still have to filter the template choice to show only templates the user is allowed to read.
(from redmine: written on 2016-07-05)
By Côme Chilliet on 2017-09-02T15:31:13 (imported from GitLab)
hello,
i removed the ou=templates acl assignement and its good that we don't need to do it :)
no acl
- i can use the template and create a user with a template ----> RESULT NOK
Complete object: read
- i can use the template and create a user with a template ----> RESULT OK
- i can read the template and everything is open ----> RESULT NOK
- the template is show in /branch1 ?? don't know if good
- Complete object: read & write
- no tested
- template_cn read
- i can read the template and everything is open --> Result NOK
- i can create a user from template ----> RESULT OK
so it seems that the read is not correctly interpreted
Cheers
(from redmine: written on 2016-07-05)
By bmortier on 2017-09-02T15:31:13 (imported from GitLab)
Côme BERNIGAUD wrote:
Using From Template creation should work from anywhere now. (Hoping this does not break anything else).
That is working, asked martinus to check on his instance if we broke acl somewhere
Also, menu creation options should now only be shown if the user have enough right.
yes its working
I still have to filter the template choice to show only templates the user is allowed to read.
see acl problem below
(from redmine: written on 2016-07-05)
By bmortier on 2017-09-02T15:31:13 (imported from GitLab)
Benoit MORTIER wrote:
hello,
i removed the ou=templates acl assignement and its good that we don't need to do it :)
It is needed for the user to be able to read the template in order to use it.
no acl
- i can use the template and create a user with a template ----> RESULT NOK
Yes this should be fixed now, template with no read rights won’t be in the list anymore.
Complete object: read
- i can use the template and create a user with a template ----> RESULT OK
- i can read the template and everything is open ----> RESULT NOK
- the template is show in /branch1 ?? don't know if good
I’m not sure how to reproduce this. In the test I did I cannot edit a template if I have no rights. I expect in your case the template is in a branch where the user have enough right to edit user fields and this is why he can edit them.
- Complete object: read & write
- no tested
- template_cn read
- i can read the template and everything is open --> Result NOK
- i can create a user from template ----> RESULT OK
As far as I know template_cn read and complete object read are the same as template_cn is the only field in this object from the ACL point of view.
(from redmine: written on 2016-07-06)
By Côme Chilliet on 2017-09-02T15:31:13 (imported from GitLab)
added Added label
By bmortier on 2018-09-28T20:05:36 (imported from GitLab)
